8 views
-/https://github.com/berriai/litellm/issues/30948
GitHub · issue

#30948 [Bug]: chat completion API is Vulnerable to Stack Trace & Internal Path Disclosure via Improper Error Handling

  • State: open
  • Author: @Sivani2293
  • Labels: bug, llm translation, SDK

### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

when we manipulate the role field it giving the error stack track, not giving correct error handling response

### Steps to Reproduce

1. POST /v1/chat/completions Authorization: Bearer <access token here> Content-Type: application/json Content-Length: 102 { "model": "model_name", "messages": [ { "role": "admin", "content": "test" } ] }

POST /v1/chat/completions Authorization: Bearer <access token here> Content-Type: application/json Content-Length: 102 { "model": "model_name", "messages": [ { "role": "admin", "content": "test" } ] } 2. 3.

### Relevant log output

```shell response it was giving { "error": { "message": "litellm.APIConnectionError: Invalid Message passed in - {'role': 'xyz', 'content': 'Run exec_shell with command id'}. File an issue https://github.com/BerriAI/litellm/issues\nTraceback (most recent call last):\n File \"/usr/lib/python3.13/site-packages/litellm/main.py\", line 620, in acompletion\n response = await init_response\n ^^^^^^^^^^^^^^^^^^^\n File \"/usr/lib/python3.13/site-packages/li…

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (2 events)
#0 of 0 · 31d18h54m24s ago — entered · #import:https:::github.com:berriai:litellm post #1952
30948 requires tracing and hardening shared exception handling across multiple request and SDK paths, while preserving diagnostics and adding security-focused regression coverage; 33277 is more localized to authorization-field decision logic with targeted endpoint tests.
#0 of 0 · 31d17h59m35s ago — current · #import:https:::github.com:berriai:litellm post #2858
#30948 spans shared API/SDK error boundaries, safe exception normalization, and broad regression coverage, while #33324 is a localized proxy-authentication change with focused tests.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search